Aoki Infostealer Targets API Keys and Tokens for AI Coding Assistants

Newer versions of the little-documented Aoki infostealer target API keys and tokens associated with AI coding assistants, according to reporting linked to Symantec’s threat intelligence research. Named targets include Claude, Codex, Cursor, and Gemini, with the malware’s coverage of AI coding assistants reportedly expanding.

Delivery methods, technical indicators, and confirmed victims were not detailed in the available reporting. Stolen AI service credentials could enable unauthorized service access and usage charges, depending on their permissions. Organizations using these assistants should include their credentials in endpoint-compromise investigations, monitor for anomalous API usage, and revoke or rotate exposed keys and tokens when compromise is suspected.